Wednesday 13 January 2010

Quickpost: New Versions of PDFiD and pdf-parser

A new version of PDFiD (V0.0.10): to deal with PDF samples trying to evade detection by preceding the header with some random bytes, I use less stringent conditions to identify a PDF file. If PDFiD finds keyword %PDF in the first 1024 bytes of a file, it assumes it’s a PDF file and starts analyzing it.

A new version of pdf-parser (v0.3.7):

added support for filters /LZWDecode and /RunLengthDecode

added a –dump option to extract the unfiltered data of a stream object (useful when the data is not actually compressed, but a payload)